Description

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-04T12:17:22.557Z",
  "pubdate": "2026-09-04T12:17:22.557Z",
  "executiveSummary": "phpMyFAQ versions prior to 4.1.8 are susceptible to an authorization bypass vulnerability within the question creation mechanism. The flaw exists in the isAddingQuestionsAllowed() method, which fails to correctly validate user permissions when the application configuration setting main.enableAskQuestions is active.\nThe vulnerability allows unauthenticated attackers to circumvent the intended security policy defined by the records.allowQuestionsForGuests configuration, which is designed to restrict guest submissions. By successfully interacting with the question/create API endpoint, unauthorized users can inject arbitrary content directly into the administrative moderation queue.\nThis vulnerability poses a significant risk to the integrity of the administrative workflow. An attacker can leverage this flaw to perform automated spam injection or mass-submission campaigns, potentially overwhelming support staff and degrading system performance or trust. The flaw resides in the core authentication logic of the question submission process, requiring no prior credentials or elevated privileges for successful exploitation. Organizations running affected versions are exposed to unauthorized data ingestion via standard web protocols, necessitating an immediate update to the latest patched release to enforce proper guest submission controls.",
  "technicalDetails": "The vulnerability is rooted in a flawed implementation of access control logic within the phpMyFAQ core framework. Specifically, the isAddingQuestionsAllowed() method fails to maintain proper boundary enforcement for guest users. While the application utilizes the configuration setting records.allowQuestionsForGuests to define the submission policy for non-authenticated users, the conditional logic within isAddingQuestionsAllowed() evaluates solely based on the global state of main.enableAskQuestions.\nWhen main.enableAskQuestions is set to true, the application logic proceeds to grant submission access to all incoming callers without verifying the status of records.allowQuestionsForGuests. This creates an authorization bypass where the security check intended to filter guest requests is effectively nullified.\nThe attack vector involves the abuse of the question/create API endpoint. An attacker can construct a POST request to this endpoint, providing the required parameters for a new FAQ question. Because the system performs an improper check on the user's authorization status, the API treats the request as a legitimate submission even when the guest submission feature is explicitly disabled by the administrator.\nThe step-by-step exploitation flow occurs as follows: 1) The attacker identifies that the application is running an affected version of phpMyFAQ. 2) The attacker crafts an HTTP POST request targeting the question/create API endpoint. 3) The request reaches the isAddingQuestionsAllowed() method, which triggers the faulty logic check. 4) The method observes that main.enableAskQuestions is enabled and returns a positive authorization status, erroneously ignoring the secondary requirement of records.allowQuestionsForGuests. 5) The API accepts the user-supplied data and persists it into the database for administrative review.\nThe post-exploitation impact includes the potential for persistent spam injection into the moderation queue. This can lead to service disruption or manual overhead for administrators tasked with filtering malicious submissions. As the vulnerability is located at the API level, the exposure is network-wide, permitting any actor capable of reaching the application's web interface to conduct exploitation without the need for authentication headers or session tokens. The absence of strict input validation combined with this broken access control allows for high-volume automated attacks."
}